HIGH Introduced in 5.3
rdma CounterRelease UAF
CVE-2026-92509
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
01Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/core: Fix potential use after free in counter_release() When accessing a counter via the netlink path the only synchronization mechanism for the said counter is rdma_restrack_get(). Currently, rdma_restrack_del() is invoked at the end of counter_release(), which is too late, since by that point vendor-specific resources associated with the counter might already be freed. This can leave a short window where the counter remains accessible through restrack, leading to a potential use-after-free. Fix this by moving the rdma_restrack_del() call to be before the freeing of the vendor-specific resources, ensuring that the counter is removed from restrack before its internal resources are released. This guarantees that no new users hold references to a counter that is in the process of destruction.
02KernelScan AI Analysis
Risk summary
A local attacker who can access the RDMA netlink interface can race a counter-destruction path against a restrack query, causing a use-after-free on kernel heap memory. This can lead to privilege escalation, information disclosure, or denial of service. The bug requires RDMA/InfiniBand hardware to be present on the system.
Vulnerability analysis
When an RDMA counter is destroyed, the cleanup path frees vendor-specific resources before removing the counter from the resource tracking database, leaving a window where a concurrent netlink query can still find the counter and access its already-freed internals. Additionally, the lookup path takes a reference without checking whether the refcount has already reached zero, so it can hand out a pointer to a counter that is mid-teardown. The fix moves the resource-tracking removal to before any vendor resources are freed, and switches the lookup to an atomic refcount check that refuses to return a counter whose last reference is already gone. The bug is reachable locally through the RDMA netlink interface, which requires CAP_NET_ADMIN — obtainable by an unprivileged user inside a user namespace — and requires RDMA/InfiniBand hardware to be present on the system.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 6.1 | 5.3 | 6.1.188 | 5eb0c57a8b56 |
| 6.12 | 5.3 | 6.12.110 | 2f0c6705e26b |
| 6.18 | 5.3 | 6.18.52 | 8c013e3a8d82 |
| 6.6 | 5.3 | 6.6.157 | d5cc211e8c39 |
| 7.2 | 5.3 | 7.2.6 | 64c72390d840 |
| mainline | 5.3 | 7.3 | 235ef2d0e750 |
| cip/6.1 | 5.3 | 6.1.189-cip61 | 5eb0c57a8b56 |
| cip/6.1-rt | 5.3 | 6.1.189-cip61-rt32 | 5eb0c57a8b56 |
| cip/6.12 | 5.3 | 6.12.111-cip32 | 2f0c6705e26b |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.111-cip32 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |
| cip/5.10 | Affected — no CIP fix yet (latest 5.10.271-cip78) |
| cip/5.10-rt | Affected — no CIP fix yet (latest 5.10.268-cip77-rt34) |